A command injection vulnerability has been identified in the release_update.yml workflow of Lawnchair. The flaw arises because user‑supplied input is not properly quoted, allowing shell metacharacters to be interpreted by the GitHub Actions runner. This is a CWE‑77 condition that enables attackers who can trigger the workflow dispatch to run arbitrary shell commands, effectively achieving remote code execution in the runner environment.

The affected software is Lawnchair, an open‑source Android home app maintained by LawnchairLauncher. All releases that include the vulnerable workflow file before the commit fcba413f55dd47f8a3921445252849126c6266b2 are susceptible. Applying the referenced commit or any later release that incorporates it removes the flaw.

The CVSS score of 7.4 classifies this defect as high severity, while the EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker can invoke the release_update.yml workflow with sufficient permissions; the likely attack vector is an authorized user or compromised credentials capable of dispatching the workflow, after which arbitrary code would execute on the runner host.